Deepfake-resistant verification

What it does

It removes recognition of a person as a means of authentication. Processes that move money, change access or release data are redesigned so that a convincing likeness is not enough. Owners of payment, access and customer verification processes are accountable; the chief information security officer sets the standard.

How to implement it

• Identify every process in which staff act on a request because they recognise the requester.
• Require confirmation on a second channel that the requester did not supply, such as a call back to a number on record.
• Use possession-based or cryptographic factors for authentication.
• Apply dual authorisation to payments and changes of bank details.
• Remove voice as a sole factor for customer authentication.
• Train staff with realistic examples, and make refusal of urgent requests acceptable.

Evidence it operates

Design: process documents showing the verification steps and that none relies on likeness alone. Operation: records of call-backs and dual approvals for sampled transactions; results of simulated impersonation exercises; training completion.

Where it fits

Applied in the design of high-value processes and in staff training. It is the primary control for AI-enabled social engineering of staff.

Limits

Procedures are bypassed under pressure, which is what the attacker applies. A second channel that is itself compromised, such as a redirected telephone number, gives no protection. Detection tools for synthetic media are unreliable and should support, not replace, procedural checks. Customers need the same protection as staff: the organisation should tell them which channels it will never use to ask for a transfer or a credential.